Algorithms to Accelerate Multiple Regular Expressions Matching for Deep Packet Inspection

Transcription

1 Algorithms to Aelerate Multiple Regular Expressions Mathing for Deep Paket Inspetion Sailesh Kumar Washington University Computer Siene an Engineering St. Louis, MO Sarang Dharmapurikar Washington University Computer Siene an Engineering St. Louis, MO Fang Yu University of California, Berkeley Department of Computer Siene Berkeley, CA Patrik Crowley Washington University Computer Siene an Engineering St. Louis, MO Jonathan Turner Washington University Computer Siene an Engineering St. Louis, MO ABSTRACT There is a growing eman for network evies apale of examining the ontent of ata pakets in orer to improve network seurity an provie appliation-speifi servies. Most high performane systems that perform eep paket inspetion implement simple string mathing algorithms to math pakets against a large, ut finite set of strings. However, there is growing interest in the use of regular expression-ase pattern mathing, sine regular expressions offer superior expressive power an flexiility. Deterministi finite automata (DFA) representations are typially use to implement regular expressions. However, DFA representations of regular expression sets arising in network appliations require large amounts of memory, limiting their pratial appliation. In this paper, we introue a new representation for regular expressions, alle the Delaye Input DFA (D FA), whih sustantially reues spae requirements as ompare to a DFA. A D FA is onstrute y transforming a DFA via inrementally replaing several transitions of the automaton with a single efault transition. Our approah ramatially reues the numer of istint transitions etween states. For a olletion of regular expressions rawn from urrent ommerial an aaemi systems, a D FA representation reues transitions y more than 9%. Given the sustantially reue spae requirements, we esrie an effiient arhiteture that an perform eep paket inspetion at multi-gigait rates. Our arhiteture uses multiple on-hip memories in suh a way that eah remains uniformly oupie an aesse over a short uration, thus effetively istriuting the loa an enaling high throughput. Our Permission to make igital or har opies of all or part of this work for personal or lassroom use is grante without fee provie that opies are not mae or istriute for profit or ommerial avantage an that opies ear this notie an the full itation on the first page. To opy otherwise, or repulish, to post on servers or to reistriute to lists, requires prior speifi permission an/or a fee. SIGCOMM'06, Septemer -, 006, Pisa, Italy. Copyright 006 ACM /06/ $.00. arhiteture an provie ost-effetive paket ontent sanning at OC-9 rates with memory requirements that are onsistent with urrent ASIC tehnology. Categories an Sujet Desriptors C..0 [Computer Communiation Networks]: General Seurity an protetion (e.g., firewalls) General Terms Algorithms, Design, Seurity. Keywors DFA, regular expressions, eep paket inspetion.. INTRODUCTION Many ritial network servies hanle pakets ase on payloa ontent, in aition to the struture information foun in paket heaers. Forwaring pakets ase on ontent (either for the purpose of appliation-level loa-alaning in a we swith or seurity-oriente filtering ase on ontent signatures) requires new levels of support in networking equipment. Traitionally, this eep paket inspetion has een limite to omparing paket ontent to sets of strings. State-of-the-art systems, however, are replaing string sets with regular expressions, ue to their inrease expressiveness. Several ontent inspetion engines have reently migrate to regular expressions, inluing: Snort [], Bro [], Com s TippingPoint X0 [0], an various network seurity applianes from Ciso Systems []. Ciso, in fat, has integrate the regular expression ase ontent inspetion apailities into its Internetworking Operating System (IOS) []. Aitionally, layer 7 filters ase on regular expressions [0] are availale for the Linux operating system. While flexile an expressive, regular expressions have traitionally require sustantial amounts of memory, whih severely limits performane in the networking ontext. To see why, we must onsier how regular expressions are implemente. A regular expression is typially represente y a

2 eterministi finite automaton (DFA). For any regular expression, it is possile to onstrut a DFA with the minimum numer of states [, ]. The memory neee to represent a DFA is, in turn, etermine y the prout of the numer of states an the numer of transitions from eah state. For an ASCII alphaet, eah state will have 6 outgoing eges. Typial sets of regular expressions ontaining hunres of patterns for use in networking yiel DFAs with tens of thousans of states, resulting in storage requirements in the hunres of megaytes. Tale ompression tehniques are not effetive for these tales ue to the relatively high numer of unique next-states from a given state. Consequently, traitional approahes quikly eome infeasile as rule sets grow. In this paper, we introue a highly ompat DFA representation. Our approah reues the numer of transitions assoiate with eah state. The main oservation is that groups of states in a DFA often have iential outgoing transitions an we an use this upliate information to reue memory requirements. For example, suppose there are two states s an s that make transitions to the same set of states, {S}, for some set of input haraters, {C}. We an eliminate these transitions from one state, say s, y introuing a efault transition from s to s that is followe for all the haraters in {C}. Essentially, s now only maintains unique next states for those transitions not ommon to s an s an uses the efault transition to s for the ommon transitions. We refer to a DFA augmente with suh efault transitions as a Delaye Input DFA (D FA). In pratie, the proper an effetive onstrution of the efault transitions leas to a traeoff etween the size of the DFA representation an the memory anwith require to traverse it. In a stanar DFA, an input harater leas to a single transition etween states; in a D FA, an input harater an lea to multiple efault transitions efore it is onsume along a normal transition. Our approah ahieves a ompression ratio of more than 9% on typial sets of regular expressions use in networking appliations. Although eah input harater potentially requires multiple memory aesses, the high ompression ratio enales us to keep the ata struture in on-hip memory moules, where the inrease anwith an e provie effiiently. To explore the feasiility of this approah, we esrie a singlehip arhiteture that employs a moest of amount on-hip memory, organize in multiple inepenent moules. Moern VLSI tehnology easily enales this sort of integration of several emee memories on a single ie; for example, IBM s ASIC fariation tehnology [] an integrate up to 00 Mits of emee memory on one hip. We use multiple emee memories to provie ample anwith. However, in orer to eterministially exeute the ompresse automata at high rates, it is important that the memory moules are uniformly populate an aesse over short perios of time. To this en, we evelop loa alaning algorithms to map our automata to the memory moules in suh a way that eterministi worst-ase performane an e guarantee. Our algorithms an maintain throughput at 0 Gps while mathing thousans of regular expressions. To summarize, our ontriutions are a) the D FA representation of regular expressions whih signifiantly reues the amount of memory require, ) a single-hip arhiteture that uses the D FA representation, an ) a loa alaning algorithm whih ensures that on-hip resoures are uniformly use, therey enaling worst-ase performane guarantees. The remainer of the paper is organize as follows. Bakgroun on regular expressions an relate work are presente in Setion. Setion esries the D FA representation. Details of our onstrution algorithm an the ompression results are presente in Setion. Setion presents the system arhiteture, loa alaning algorithms an throughput results. The paper ens with onluing remarks in Setion 6.. BACKGROUND AND RELATED WORK Deep paket inspetion has reently gaine popularity as it provies the apaility to aurately lassify an ontrol traffi in terms of ontent, appliations, an iniviual susriers. Ciso an others toay see eep paket inspetion happening in the network an they argue that Deep paket inspetion will happen in the ASICs, an that ASICs nee to e moifie [9]. Some important appliations requiring eep paket inspetion are liste elow: Network intrusion etetion an prevention systems (NIDS/NIPS) generally san the paket heaer an payloa in orer to ientify a given set of signatures of well known seurity threats. Layer 7 swithes an firewalls provie ontent-ase filtering, loa-alaning, authentiation an monitoring. Appliationaware we swithes, for example, provie salale an transparent loa alaning in ata enters. Content-ase traffi management an routing an e use to ifferentiate traffi lasses ase on the type of ata in pakets. Deep paket inspetion often involves sanning every yte of the paket payloa an ientifying a set of mathing preefine patterns. Traitionally, rules have een represente as exat math strings onsisting of known patterns of interest. Naturally, ue to their wie aoption an importane, several high spee an effiient string mathing algorithms have een propose reently. Some of the stanar string mathing algorithms suh as Aho- Corasik [7] Commentz-Walter [8], an Wu-Maner [9], use a preproesse ata-struture to perform high-performane mathing. A large oy of researh literature has onentrate on enhaning these algorithms for use in networking. In [], Tuk et al. presents tehniques to enhane the worst-ase performane of Aho-Corasik algorithm. Their algorithm was guie y the analogy etween IP lookup an string mathing an applies itmap an path ompression to Aho-Corasik. Their sheme has een shown to reue the memory require for the string sets use in NIDS y up to a fator of 0 while improving performane y more than 0%. Many researhers have propose high-spee pattern mathing harware arhitetures. In [] Tan et al. propose an effiient algorithm that onverts an Aho-Corasik automaton into multiple inary state mahines, therey reuing the spae requirements. In [], the authors present an FPGA-ase esign whih uses harater pre-eoing ouple with CAM-ase pattern mathing. In [], Yusuf et al. use harware sharing at the it level to exploit logi esign optimizations, therey reuing the area y a further 0%. Other work [, 6, 7, 8, 9] presents several effiient string mathing arhitetures; their performane an spae effiieny are well summarize in []. In [], Sommer an Paxson note that regular expressions might prove to e funamentally more effiient an flexile as

3 ompare to exat-math strings when speifying attak signatures. The flexiility is ue to the high egree of expressiveness ahieve y using harater lasses, union, optional elements, an losures, while the effiieny is ue to the effetive shemes to perform pattern mathing. Open soure NIDS systems, suh as Snort an Bro, use regular expressions to speify rules. Regular expressions are also the language of hoie in several ommerial seurity prouts, suh as TippingPoint X0 [0] from Com an a family of seurity applianes from Ciso Systems []. Although some speialize engines suh as RegEx from Tarari [] report paket san rates up to Gps, the throughput of most suh evies remains limite to su-gigait rates. There is great interest in an inentive for enaling multigigait performane on regular expressions ase rules. Consequently, several researhers have reently propose speialize harware-ase arhitetures whih implement finite automata using fast on-hip logi. Sinhu et al. [] an Clark et al. [6] have implemente noneterministi finite automata (NFAs) on FPGA evies to perform regular expression mathing an were ale to ahieve very goo spae effiieny. Implementing regular expressions in ustom harware was first explore y Floy an Ullman [8], who showe that an NFA an e effiiently implemente using a programmale logi array. Mosola et al. [7] have use DFAs instea of NFAs an emonstrate signifiant improvement in throughput although their atasets were limite in terms of the numer of expressions. These approahes all exploit a high egree of parallelism y enoing automata in the parallel logi resoures availale in FPGA evies. Suh a esign hoie is guie partly y the aunane of logi ells on FPGA an partly y the esire to ahieve high throughput as suh levels of throughput might e iffiult to ahieve in systems that store automata in memory. While suh a hoie seems promising for FPGA evies, it might not e aeptale in systems where the expression sets nees to e upate frequently. More importantly for systems whih are alreay in eployment, it might prove iffiult to quikly resynthesize an upate the regular expressions iruitry. Therefore, regular expression engines whih use memory rather than logi, are often more esirale as they provie higher egree of flexiility an programmaility. Commerial ontent inspetion engines like Tarari s RegEx alreay emphasize the ease of programmaility provie y a ense multiproessor arhiteture ouple to a memory. Content inspetion engines from other venors [, ], also use memoryase arhitetures. In this ontext, Yu et al. [0] have propose an effiient algorithm to partition a large set of regular expressions into multiple groups, suh that overall spae neee y the automata is reue ramatially. They also propose arhitetures to implement the groupe regular expressions on oth general-purpose proessor an multi-ore proessor systems, an emonstrate an improvement in throughput of up to times. In this paper, we exten these memory-ase arhitetures an propose algorithms whih an enale the effiient implementation of regular expressions at multi-gigait rates while preserving the flexiility provie y programmaility.. DELAYED INPUT DFAS It is well-known that for any regular expression set, there exists a DFA with the minimum numer of states []. The memory neee to represent a DFA is etermine y the numer of transitions from one state to another, or equivalently, the numer of eges in the graph representation. For an ASCII alphaet, there an e up to 6 eges leaving eah state, making the spae requirements exessive. Tale ompression tehniques an e applie to reue the spae in situations when the numer of istint next-states from a given state is small. However, in DFAs that arise in network appliations, these methos are typially not very effetive eause on average, there are more than 0 istint next-states from various states of the automaton. We introue a moifiation to the stanar DFA that an e represente muh more ompatly. Our moifiations are ase on a tehnique use in the Aho-Corasik string mathing algorithm [7]. We exten their tehnique an apply it to DFAs otaine from regular expressions, rather than simple string sets.. Motivating Example We introue our approah using an example. The left sie of Figure shows a stanar DFA efine on the alphaet {a,,,} that reognizes the three patterns, p =a +, p = +, an p = * + (in these expressions, the asterisk represents 0 or more repetitions of the immeiately preeing su-expression, while the plus sign represents one or more repetitions). In this DFA, state is the initial state, an states, an are math states for the three patterns p, p an p, respetively. The right sie of Figure shows an alternate type of DFA, whih inlues unlaele eges that are referre to as efault transitions. When mathing an input string, a efault transition is use to etermine the next state, whenever the urrent state has no outgoing ege laele with the urrent input harater. When following a efault transition the urrent input harater is retaine. Consier the operation of the two automata on the input string aa. For this input, the sequene of states visite y the left-han automaton is, where the unerline states are the math states that etermine the output value for this input string. The right-han automaton visits states. Notie that the sequene of math states is the same, so if the seon output assoiates these states with the same three patterns, it proues the same output as the first one. Inee, it is not iffiult to show that the two automata visit the same sequene of math states for any input string. That is, they proue the same output, for all inputs an are hene equivalent. Note that the right-han automaton in Figure has just nine eges, while the one on the left has 0. We fin that for the more omplex DFAs that arise in network appliations, we an generally reue the numer of eges y more than 9%, ramatially reuing the spae neee to represent the DFA. There is a prie for this reution of ourse, sine no input is onsume when efault eges are followe. In the example in Figure, no state with an inoming efault transition also has an outgoing efault transition, meaning that for every two eges traverse, we are guarantee to onsume at least one input harater. Allowing states to have oth inoming an outgoing efault transitions leas a more ompat representation, at the ost of some reution in the worst-ase performane.. Prolem Statement We refer to an automaton with efault transitions as a Delaye Input DFA (D FA). We represent a D FA y a irete graph,

4 a a a a a a Figure. Example of automata whih reognize the expressions a +, +, an * + whose verties are alle states an whose eges are alle transitions. Transitions may e laele with symols from a finite alphaet Σ. Eah state may have at most one unlaele outgoing transition, alle its efault transition. One state is esignate as the initial state an for every state s, there is a (possily empty) set of mathing patterns, µ(s). For any input string x Σ, we efine the estination state, δ(x) to e the last state reahe y starting at the initial state an following transitions laele y the haraters of x, using efault transitions whenever there is no outgoing transition that mathes the next harater of x (so, for the D FA on the right sie of Figure, δ(a)= an δ(a)=). We generalize δ to aept an aritrary starting state as a seon argument; so for the D FA on the right sie of Figure, δ(a,) =. Consier two D FAs with estination state funtions δ an δ, an mathing pattern funtions µ an µ. We say that the two automata are equivalent if for all strings x, µ (δ (x))=µ (δ (x)). In general, given a DFA that reognizes some given set of regular expressions, our ojetive is to fin an equivalent D FA that is sustantially more memory-effiient. We an oun the worst-ase performane of a D FA in terms of the length of its longest efault path (that is, a path omprising only efault transitions). In partiular, if the longest efault path has k transitions, then for all input strings, the D FA will onsume at least one harater for every k transitions followe. To ensure that a D FA meets a throughput ojetive, we an plae a limit on the length of the longest efault path. This leas to a more refine version of the prolem statement, in whih we seek the smallest equivalent D FA that satisfies a speifie oun on efault path length.. Converting DFAs to D FAs Although, we are in general intereste in any equivalent D FA, for a given DFA, we have no general proeure for synthesizing a D FA iretly. Consequently, our proeure for onstruting a D FA proees y transforming an orinary DFA, y introuing efault transitions in a systemati way, while maintaining equivalene. Our proeure oes not hange the state set, or the set of mathing patterns for a given state. Hene, we an maintain equivalene y ensuring that the estination state funtion δ(x), oes not hange. Consier two states u an v, where oth u an v have a transition laele y the symol a to a ommon thir state w, an no efault transition. If we introue a efault transition from u to v, we an eliminate the a-transition from u without affeting the estination state funtion δ(x). A slightly more general version of this oservation is state elow. Lemma. Consier a D FA with istint states u an v, where u has a transition laele y the symol a, an no outgoing efault transition. If δ(a,u)=δ(a,v), then the D FA otaine y introuing a efault transition from u to v an removing the transition from u to δ(a,u) is equivalent to the original DFA. Note that y the same reasoning, if there are multiple symols a, for whih u has a laele outgoing ege an for whih δ(a,u)=δ(a,v), the introution of a efault ege from u to v allows us to eliminate all these eges. Our proeure for onverting a DFA to a smaller D FA applies this transformation repeately. Hene, the equivalene of the initial an final D FAs follows y inution. The D FA on the right sie of Figure was otaine from the DFA on the left, y applying this transformation to state pairs (,), (,), (,) an (,). For eah state, we an have only one efault transition, so it s important to hoose our efault transitions arefully to allow us to get the largest possile reution. We also restrit the hoie of efault transitions to ensure that there is no yle efine y efault transitions. With this restrition, the efault transitions efine a olletion of trees with the transitions irete towars the tree roots an we an ientify the set of transitions that gives the largest spae reution y solving a maximum weight spanning tree prolem in an unirete graph whih we refer to as the spae reution graph. The spae reution graph for a given DFA is a omplete, unirete graph, efine on the same vertex set as the DFA. The ege joining a pair of verties (states) u an v is assigne a weight w(u,v) that is one less than the numer of symols a for whih δ(a,u)=δ(a,v). The spae reution graph for the DFA on the left sie of Figure is shown in Figure. Notie that the spanning tree of the spae reution graph that orrespons to the efault transitions for the D FA in Figure has a total weight of +++=, whih is the ifferene in the numer of transitions in the two automata. Also, note that this is a maximum weight spanning tree for this graph. Figure shows D FAs orresponing

5 a a Figure. Spae reution graph for DFA in Figure. to two ifferent maximum weight spanning trees. Note that while these two automata use the same numer of eges as the one in Figure, they have efault paths of length an, respetively, meaning that their worst-ase performane will not e as goo.. BOUNDING DEFAULT PATHS If our only ojetive was minimizing the spae use y a D FA, it woul suffie to fin a maximum weight spanning tree in the spae reution graph. The tree eges orrespon to the state pairs etween whih we reate efault transitions. The only remaining issue is to etermine the orientation of the efault transitions. Sine eah vertex an have only one outgoing efault transition, it suffies to pik some aritrary state to e the root of the efault transition tree an iret all efault transitions towars this state. Unfortunately, when this proeure is applie to DFAs arising in typial network appliations, the resulting efault transition tree has many long paths, implying that the D FA may nee to make many transitions for eah input harater onsume. We an improve the performane somewhat, y seleting a tree root that is entrally loate within the spanning tree. However, this still leaves us with many long efault paths. The natural way to avoi long efault paths is to onstrut a maximum weight spanning tree with a speifie oune iameter. Unfortunately, the onstrution of suh spanning trees is NP-har [9]. It s also not lear that suh a spanning tree leas to the smallest D FA. What we atually require is a olletion of oune iameter trees of maximum weight. While this prolem an e solve in polynomial time if the iameter oun is (this is simply maximum weight mathing), the prolem remains NP-har for larger iameters. Fortunately, we have foun that fairly simple methos, ase on lassial maximum spanning tree algorithms, yiel goo results for D FA onstrution. One oneptually straight-forwar metho uils a olletion of trees inrementally. The metho (whih is ase on Kruskal s algorithm [6]) examines the eges in ereasing orer of their weight. An ege {u,v} is selete as a tree-ege so long as u an v o not alreay elong to the same tree, an so long as the aition of the ege will not reate a tree whose iameter exees a speifie oun. One all the eges have een onsiere, the tree eges efine efault transitions. We orient the efault transitions in eah tree y ireting them towars a selete root for that tree, where the roots are selete so as to minimize the istane to the root from any leaf. The one ompliation with this metho is heking the iameter ouns. We an o this effiiently y maintaining for eah vertex u a value (u) whih speifies the numer of eges in the longest Figure. D FAs orresponing to two ifferent maximum weight spanning trees tree path from u to a vertex in the same tree. These values an e use to hek that the aition of a new ege will not violate the iameter oun. When a new tree ege is ae, the istane values must e upate for verties in the tree forme y the aition of the new ege. This an e one in linear time for eah upate. Consequently, the total time neee to maintain the istane values is O(n ). Sine Kruskal s algorithm, on whih our algorithm is ase, requires O(n log n) time on omplete graphs, the iameter heking oes not inrease the asymptoti running time of the algorithm. One refinement to this fairly simple algorithm is shown elow. While examining the eges in ereasing orer of their weights, we also look for an ege among all equal weight eges, whih results in the minimum expansion in the iameter of the trees joine. In pratie, sine there are only ifferent weight values, at any point in time, there will often e plenty of equal weight eges to hoose from. The resulting refine algorithm egins with the weighte unirete spae reution graph G=(V,W) an moifies an ege set efault whih form the efault transition trees. First it onsiers all eges of weight, an inrementally onstruts efault trees of small iameters. Then it repeately onsiers smaller weight eges an as them to the efault transition trees. It turns out that the refinement generally leas to efault transition trees with signifiantly smaller iameter as ompare to a normal proeure refinemaxspantree (graph G=(V, W), moifies set ege efault); () vertex u, v; set eges; set weight-set[]; () efault := {}; eges := W; () for ege (u, v) eges () if weight(u, v) > 0 () a (u, v) to weight-set[weight(u, v)]; (6) fi (7) for integer i = to (8) o weight-set[i] [ ] (9) Selet (u, v) from weight-set[i] whih leas to the (0) smallest growth in the iameter of the efault tree () if verties u an v elongs to ifferent efault trees () if efault U (u, v) maintains the iameter oun () efault := efault U (u, v); () fi () fi (6) o (7) rof en;

6 Figure. Default transition trees forme y the spanning tree algorithm an y our refine version spanning tree, whih remains olivious aout the iameter uilup of the trees until the iameter oun is reahe. In a setup, where the iameter oun is not applie, refine spanning tree algorithm reates efault transition trees of equal weight ut relatively smaller iameter. When iameter oun is applie, the refine algorithm reates trees with higher weight too. This happens, eause a normal spanning tree, in its proess, quikly reates several trees whose iameter is too large an hene an not e further linke to any tree. The refine version ensures that tree iameter remains small; hene more trees an e linke, resulting in higher weight. In orer to illustrate the effet of this refinement, we take a syntheti DFA, whih onsists of states. All pairs of states u an v were assigne transitions on a ranom numer (rawn from a geometri istriution with suess proaility, π = 0.0, thus mean, E(X) = 9) of symols a suh that δ(a,u)=δ(a,v). Thus the weight of the eges in the spae reution graph was geometrially istriute. When we ran the normal an refine versions of spanning tree algorithms without any iameter oun, they reate spanning trees of weight 77, as shown in Figure. While the weights of oth trees are maximum, their iameters are an 0 respetively. If we hoose noes 8 an 9, respetively, as the root of these two trees, the longest efault paths will ontain 7 an eges, while the average length of efault paths will e.8 an.8, respetively. Clearly, the refinement in the spanning tree algorithm reues the memory aesses neee y a D FA for every harater. We will see in setion. that when iameter ouns are applie, refine spanning tree reates even smaller D FAs as ompare to the normal spanning tree. When we oune the iameter of the spanning tree to 7, an ran our algorithm on the same syntheti DFA, it reate three efault Figure. Default transition trees (forest) forme y the refine spanning tree with the tree iameter oune to 7 7 transition trees, as shown in Figure. The total weight of all three trees was 6, whih suggests that the resulting DF A will require slightly more spae as ompare to the one with no iameter restraint. However, ouning the iameter to 7 ensures an important property that the length of all efault paths an e easily limite to an hene the D FA will require at most memory aesses per harater.. Results on some regular expression sets In orer to evaluate the spae reutions ahieve y a elaye input DFA, or D FA, we performe experiments on regular expression sets use in a wie variety of networking appliations. Our most important ataset are the regular expression sets use in eep paket inspetion applianes from Ciso Systems [8]. This set ontains more than 70 moerately omplex expressions, whih are use to etet the anomalies in the traffi. It is wiely use aross several Ciso seurity applianes an Ciso ommonly employs general purpose proessors with a gigayte or more memory to implement them. In aition to this set, we also onsiere the regular expressions use in the open soure Snort an Bro NIDS, an in the Linux layer-7 appliation protool lassifier. Linux layer-7 protool lassifier onsists of 70 expressions. Snort ontains more than a thousan an half expressions, although, they on t nee to e mathe simultaneously. An effetive way to implement the Snort rules is to ientify the expressions for eah heaer rule an then group the expressions orresponing to the overlapping rules (the set of heaer rules a single paket an math to). We use this approah. For the Bro NIDS, we present results for the HTTP signatures, whih onsist of 68 regular expressions. Given these regular expression sets, as the first step to onstrut DFAs with a small numer of states, we use the set splitting tehniques propose y Yu et al. in [0]. It splits the regular expressions into multiple sets so that eah set reates a small DFA. We reate 0 sets of rules from the Ciso regular expressions, an were ale to reue the total memory footprint to 9 MB, as there were a total of 808 states, an eah iniviual DFA ha less than 6K states, (thus ytes enoes a state). Clearly, suh effiient grouping resulte in signifiant spae reution over more than a gigayte spae require otherwise. We split the Linux layer-7 expressions into three sets, suh that the total numer of states was For the Snort set, we present results for the heaer rule tp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS, whih onsists of omplex

7 Soure Tale. Our representative regular expression groups # of regular expressio ns Avg. ASCII length of expressions % expressions using wilars (*, +,?) % expressions length restritions {,k,+} Ciso Ciso Ciso Linux Linux Snort Snort Bro expressions. Sine Snort rules were omplex, with long length restrition on various harater lasses, we applie rewriting tehniques propose in [0] to some rules an split them further into four sets. Bro regular expressions were generally simple an effiient therefore we were ale to ompile all of them in a single automaton. The key properties of our representative regular expression groups are summarize in Tale. In orer to estimate the reution ojetives of D FA, we introue a term upliate transition. Transitions are upliate if there exists more than one of them leaing to the same next state for the same input harater. For example in Figure, if the transitions on input from states is terme original then the ones from state,, an are upliates. Even though, it may not e possile to eliminate all upliate transitions, it still gives a goo estimate on the upper oun of the numer of transitions that an e eliminate y onstruting a D FA from the DFA. After onstruting the minimum state DFAs from these regular expressions, we use oth normal an refine versions of spanning tree to onstrut the orresponing D FAs. The reution in the numer of transitions is shown in Tale with no iameter ouns applie. The length of efault paths, whih gives an estimate of the ae memory anwith a D FA will nee over a DFA, are also shown. It is lear that, D FAs eliminates nearly all upliate transitions from the DFAs. It is also apparent that refine version of spanning tree reates sustantially smaller efault paths as ompare to a normal spanning tree. In orer to get a sense of the istriution of the numer of laele transitions Numer of states Numer of transitions at a state Figure 6. Distriution of numer of transitions per state in the D FA onstrute from the Ciso90 expression set per states of a D FA, we plot it in Figure 6, for the Ciso regular expression group ontaining 90 expressions. Majority of states has or fewer laele transitions. Note that most states have transitions eause most rules are ase insensitive, like [-ed-e0-9\-_][/\\][^/\\\r\n?\x6\s\t:]*[.][nn][uu]. Sine the aove results are with no iameter restritions, efault transition paths are quite long. In orer to ahieve smaller efault paths, we ran our algorithm with the iameter restrite to a small onstant. In this ase, we first ompare the reutions ahieve y normal spanning tree an y our refine version. In Tale, we report the numer of transitions in the resulting D FA, with the length of efault paths oune to eges. Clearly, refine version of spanning tree yiels relatively more ompat D FA. In Figure 7, we plot the reution in the numer of transitions of a Tale. Numer of transitions in D FA with efault path length oune to DFA Normal spanning tree Refine spanning tree Ciso Ciso Ciso Linux Linux0 9 0 Snort Bro Tale. Original DFA an the D FA onstrute using the normal an the refine spanning tree, without any iameter oun Original DFA Delaye input DFA, D FA Normal spanning tree Refine spanning tree DFA Total # of Total # of Total # of Total # of % Total # of % Avg. Max. Total # of % Avg. Max. states transitions istint upliate upli transitions reuti efault efault transitions reuti efault efault transitions transitions ates on length length on length length Ciso Ciso Ciso Linux Linux Snort Bro

8 # transitions (as fration of the # of istint transitions in original DFA) Ciso90 Ciso0 Ciso7 Linux6 Linux0 Snort Bro Maximum efault path length Average efault path length Ciso90 Ciso0 Ciso7 Linux6 Linux0 Snort Bro Maximum efault path length Figure 7. Plotting total numer of laele transitions in D FAs for various maximum efault path length ouns DFA, as ratio of numer transitions in the D FA an numer of istint transitions (transitions leaing to istint next states ) in the original DFA, y applying the refine version of spanning tree an ouning the efault paths at ifferent values. It is ovious that smaller efault path restritions proue D FAs with relatively higher numer of laele transitions. Note that, the reution numers plotte are with respet to the total numer of istint transitions (leaing to ifferent next states ) at various states in the original DFA, an not all transitions. Clearly this metri is onservative an suggests the spae reution y D FA over a DFA using the est (possily hypothetial) tale ompression sheme whih enales it to store only the istint transitions. If we woul use the total transitions in a DFA as our metri, D FA will result in even higher reution. Figure 8 plots the average length of efault paths in these experiments. It is apparent that, the average length of efault paths (whih etermines the average performane) remains almost two times smaller than the longest ones.. Summarizing the results The results suggest that a elaye input DFA or D FA an sustantially reue the spae requirements of the regular expression sets ommonly use in many networking appliations. For example, using D FA, we were ale to reue the spae requirements of regular expressions use in eep paket inspetion applianes of Ciso Systems to less than MB. We also saw signifiant reution in the Bro an Linux layer-7 expressions. Snort expressions resulte in moerate improvements (aoring to our onservative metri) as there were fewer istint transitions per state. D FA reues the spae requirements at the ost of multiple memory aesses per harater. In fat, splitting an expression set into multiple groups as to the numer of memory aesses as it reates multiple D FAs, all of whih nees to e exeute in Memory Memory Memory... Memory D FA sanner D FA sanner D FA sanner Figure 9. Logial struture of the memory susystem... Figure 8. Plotting the average efault path length in D FAs for various maximum efault path length ouns parallel. Although, D FA performs equally well on expression sets whih are not split, we eie to split, in orer to reue the total numer of states in the DFA to egin with (e.g. 9 MB for 9 partitions of the Ciso rules versus + GB without lever rule partitioning). Suh a esign hoie makes sense in our ontext, eause we use multiple emee memories, whih provies us with ample anwith, ut limite apaity. We now present our arhiteture an algorithms to map the D FAs onto them.. REGEX SYSTEM ARCHITECTURE In this setion, we propose an effiient regular expression engine onsisting of multiple emee memories an proessors. We also propose algorithms to effiiently map the D FA onto the arhiteture. One of our esign ojetives is flexiility, so we preominantly use emee memories in orer to store the automata rather than synthesizing them in logi gates [8]. Using memory rather than logi allows the arhiteture to remain flexile in the fae of frequently upating regular expressions. In aition to ense ASIC emee memory tehnologies like IBM s [], moern FPGAs suh as the Xilinx Virtex- ontain several hunres of 8Kit memory loks [] proviing several megaytes in aggregate. The emee memories in FPGAs have multiple ports an lok rates of up to 00 MHz. Of ourse, ASIC tehnologies provie higher egree of flexiility, with the numer of ports, the size of eah memory, an the lok rate all eing esign speifi. Thus, a memory-ase esign is eminently pratial. Given this, we esign our emee memory arhiteture with the following points in min. While small memories often lok at higher rates, every aitional memory as to the overhea of the ontrol iruitry. Therefore, we inten to use an aequate numer of reasonaly size memories, so that the overall anwith remains appropriate while maintaining reasonale ontrol omplexity. Using multiple, equally-size emee memories will enale the arhiteture to sale apaity an anwith linearly with inreasing on-hip transistor ensity. A ie with several equally size memories an ahieve effiient plaement an routing, resulting in minimal waste ie area. Therefore, our esign will use memories of equal size, inepenent of the harateristis of any partiular ata set. In

9 Throughput (Gps) memory moules average performane 8 memory moules memory moules Synthetially generate worst-ase input ata memory moule 6 memory moules Numer of onurrently sanne pakets Figure 0. Throughput with efault path length oune to 7 an using the ranomize mapping fat, using several small equally size memories is a natural hoie given that the kin of expressions an the resulting automata are likely to hange very often. The resulting arhiteture onsists of a symmetri tile of equally size emee memories; the logial organization of this system is shown in Figure 9. Note that FPGAs, with hunres of fix-size memory moules, fall within the sope of this arhiteture. As an e seen, there are multiple memories, eah aessile y an array of regular expression engines. Eah engine is apale of sanning one paket at a time. Multiple engines are present to exploit the paket- an flow-level parallelism availale in most paket proessing ontexts. While throughput for an iniviual paket will e limite to that of a single memory, overall system throughput an approah the aggregate memory anwith. To o so, we must map the D FA to these memories in suh a way that, a) there is minimal fragmentation of the memory spae, so that every memory remains uniformly oupie; an ) eah memory reeives a nearly equal numer of aesses, so that none of them eomes a throughput ottlenek. We now propose algorithms to ahieve these ojetives.. Ranomize Mapping A simple uniformly ranom mapping of states to memory moules an provie salale average-ase performane. The expetation is that over a long perio of time, eah memory will reeive a nearly equal fration of all referenes. Thus, with a reasonale numer of onurrent pakets, average throughput an remain high. Consier a ase of m memory moules an p onurrently sanne pakets. If eah paket generates a rea request at an interval of l yles (i.e, the memory rea lateny), we nee to san m l pakets onurrently in orer to keep the m memories usy. In pratie, we nee more pakets ue to ranom onflits. The prolem an e moele as a alls an ins prolem. There are m ins (memory moules) an alls (memory requests) arrive to them ranomly. Only one an e servie at eah in per yle, so any remaining alls must wait for susequent memory yles. If m alls arrive ranomly, -e - will serve an rest has to wait for next yle. Thus only 6% of the memories will e usy. As more alls arrive, more memories will remain usy. Thus, sanning many pakets onurrently improves the overall throughput, while iniviual pakets are serve relatively slowly. We report the throughput of suh a ranomize arhiteture in Figure 0, assuming a ual-port emee memory running at 00 MHz an a rea aess lateny of yles. In this experiment, we have limite the longest efault paths in the D FA to 7. The input ata was generate from the MIT DARPA Intrusion Detetion Data Sets []. We inserte aitional ata into these sets so that the automaton will etet approximately % mathes. It is evient from the plots that as we inrease the numer of onurrently sanne pakets, the overall throughput sales up. Moreover, as the numer of emee memories inreases, the throughput sales almost linearly up to 8 memories, eyon whih there is little improvement. This saturation is ue to signifiant spatial loality in the automata traversal in whih some states are visite more often than the others. In fat, in some ases, we foun that a single state is visite almost 0% of the time. If suh a state resies in memory moule k, it is likely that memory moule k will limit the overall performane irrespetive of the numer of moules. However, suh situations are rare, an the average performane remains exellent. A ranomize system is also likely to have a very low worst-ase throughput as shown in Figure 0. This an e explaine as follows. A D FA often nees to traverse multiple efault transitions for a harater; if the maximum efault path length is limite to 7, then 8 state traversals might e neee for a harater. Sine the state to memory mapping is ranom, there may exist efault paths along whih all states resie in the same memory moule (or in a small numer of moules). If the input ata is suh that the automaton repeately traverses suh efault paths, then throughput will egrae. Moreover, when we map multiple automata (one for eah regular expression group) onto memory moules ranomly, efault paths of ifferent automata may map to the same memory moule. In this ase, pakets traversing those paths will e effetively proesse serially, an overall system throughput oul iminish even further. Sine this ranomize approah is sujet to these pathologial worst-ase onitions, we now propose eterministi mapping algorithms apale of maintaining worst-ase guarantees.. Deterministi an Roust Mapping The first goal of a roust an eterministi mapping is to ensure that all automata, whih are exeute simultaneously, are store in ifferent memory moules. This will ensure that eah exeutes in parallel without any memory onflits. Ahieving this goal is straight-forwar, provie that there are more memory moules than automata. The seon goal is to ensure that all states along any efault path map to ifferent memory moules. Thus, no pathologial onition an arise for long efault paths as a memory moule will e referre at most one. Another enefit of this approah is that we will nee fewer onurrent pakets to ahieve a given level of throughput, ue to the etter utilization of. Prolem Formulation: We an formulate the aove prolem as a graph oloring prolem, where olors represent memory moules an efault paths of D FA represent the graph. As we have seen, these paths form a forest, where verties represent states an irete eges represent efault transitions. Our goal is to olor the verties of the forest so that all verties along any path from a leaf to the root are olore with ifferent olors. Moreover, we

10 nee to ensure that every olor is nearly equally use, so that memories remains uniformly oupie. Clearly, if is the longest efault path, i.e. the epth of the eepest tree, then we nee at least + olors. We present two heuristi algorithms, to olor the trees in the forest... Deterministi an Roust Mapping The max-min algorithm is similar to the first-fit, ereasing inpaking heuristi [7], one of the est known heuristis for solving the NP-omplete in paking prolem. The algorithm is formally esrie aove, where the irete graph D represents the efault transitions an C the set of all olors. The algorithm proees y orering the efault transition trees aoring to their size (i.e., the numer of verties times the size of eah vertex). Then, in ereasing orer of size, it olors eah tree suh that all verties at ifferent epths are olore with one of the + olors. Sine there are a total of + olors an the maximum epth of a tree is, verties along all efault paths are guarantee to get ifferent olors. In orer to ensure that olors are nearly equally use, max-min heuristis are use. For a urrently selete tree, it groups the verties at ifferent epths an sorts the group with respet to the size of all verties in the group. Then, it assigns the most use olor to the smallest group an the least use olor to the largest group. When the forest onsists of a large numer of trees, max-min oloring ensures that olors are nearly equally use; therey ensuring that ifferent memory moules will remain uniformly oupie. However, when there are a small numer of trees, the max-min algorithm often leas to uneven memory usage. A simple example is shown on the left han sie of Figure, where there are two trees whih are olore with olors. With the maxmin algorithm, olor is use to olor 7 verties, while olors, an are eah use to olor only verties. An alternative oloring, whih uses eah olor uniformly an also ensures that verties along a efault path uses ifferent olors, is shown on the right han sie in the same figure. We now propose an algorithm whih proues suh oloring... Aaptive oloring algorithm The max-min algorithm performs poorly eause it oes not exploit situations when multiple olors are availale to olor a vertex. For instane, in the example shown in figure, the maxmin algorithm assigne olor to all verties at epth, although five of these six verties an e olore with either olor or. In pratie, a D FA reates efault trees with many suh opportunities. This aaptive algorithm exploits this power of multiple hoies an results in a more uniform olor usage. A natural way to onstrut a D FA is to limit the efault path length to the numer of memory moules (olors) availale to it Figure. Left iagram shows two trees olore y max-min algorithm. Right iagram shows a etter oloring proeure max-min-oloring (graph D(V, W), set olor C); () heap h,, l; () for tree t D () for vertex u t size(t) := size(t) + size(u); rof () h.insert(t, size(t)); () rof (6) for olor j C.insert(j, 0); rof (7) o h [ ] (8) t := h.finmax(); h.remove(t); (9) for all epth values i t (0) l.insert(i, size of all verties at epth i); () rof () olor j :=.finmax(); () o l [ ] () epth i := l.finmin(); size s := l.key(i); l.remove(); () Color verties at epth i in tree t with olor j; (6).hangekey(j,.key(j) + s); (7) j :=.finnextmax(); (8) o (9) o en; proeure aaptive-oloring (graph D(V, W), set olor C); () heap h; () for olor C use[] := 0; eprive[] := 0; rof () for vertex u V () set olor olors[u] := C; () h.insert(u, epth(u)); (6) rof (7) o h [ ] (8) u := h.finmax(); h.remove(u); (9) if olors[u] > assign-olor(u, D, C); fi (0) o en; proeure assign-olor (vertex u, graph D(V, W), set olor C); () olor ; () Pik from olors[u] with min use[] an max eprive[]; () olors[u] := ; () use[] := use[] + size(u); () for v esenents(u) olors[v] := olors[v] ; rof (6) for v anestors(u) olors[v] := olors[v] ; rof (7) alulate-eprive(d, C); (8) if ef-trans(u) NULL assign-olor(ef-trans(u), D, C); fi en; proeure alulate-eprive (graph D(V, W), set olor C); () for olor C eprive[] := 0; rof () for vertex u V () if olors[u] = () olor := olors[u]; () for v esenents(u) (6) if olors[v] > eprive[] += size(v); fi (7) rof (8) fi (9) rof en;

11 {,,,} {,,,} {} {,,,} {} {} {,,,} {,,,} {,,,} {,,,} {} {,,} {,,,} {,,,} {} {,,} {,,} {} {,,,} {,,,} {} {,,,} {} {} {,,,} {,,,} {,,,} {,,,} {,,,} {,} {,} {,,} {,,} {,,} {,} {,} {,,} {,,} {,,} {,,,} {} {} {} {} use[] = 0 eprive[] = 0 use[] = 0 eprive[] = 0 use[] = 0 eprive[] = 0 use[] = 0 eprive[] = 0 {,,,} {,,,} use[] = eprive[] = 0 use[] = eprive[] = 0 use[] = eprive[] = use[] = eprive[] = 6 {,,,} {,,,} use[] = eprive[] = 0 use[] = eprive[] = use[] = eprive[] = use[] = eprive[] = 6 Colore impliitly as its olor set is left with a single olor {} {} {} {} {} {} {} {,,} {,,} {} {} {} {,,} {} {} {} {} {} {} {} {} {} {,,} {,,} {,,} use[] = eprive[] = 0 use[] = eprive[] = use[] = eprive[] = 0 use[] = eprive[] = {} {} {} {} {} {} {} {} {,} {,} use[] = eprive[] = 0 use[] = eprive[] = use[] = eprive[] = 0 use[] = eprive[] = {} {} {} {} {} {} {} {} {} {} use[] = eprive[] = 0 use[] = eprive[] = 0 use[] = eprive[] = 0 use[] = eprive[] = 0 {} {} {} Figure. Various steps involve in the oloring of two trees with aaptive algorithm (assuming equally size verties) Max isrepany in olor usage Numer of efault transition trees in the forest Figure. Plotting maximum isrepany in olor usage, irles for max-min an squares for aaptive algorithm It egins y assigning a set of all C olors to all verties an then removes olors from eah set until every vertex is fully olore (i.e. a single olor left in their set). In orer to remove appropriate olors, it keeps trak of two variales for every olor. The first variale use traks the total numer of verties olore y eah olor, an the seon variale eprive traks the future hoies of olors that remain in the sets of those verties not yet fully olore. More speifially, for every olor, eprive maintains the numer of the verties, whih are eprive of using it, as it has een remove from their olor set an use maintains the numer of verties olore with it. Clearly, the goal is to more often use olors a) whih most of the verties are eprive of an ) with whih fewest verties are fully olore with. After initializing the olor sets of eah vertex, the next step is to eie an orering of the verties, in whih olors will e remove from their olor set. An effetive orering is to first hoose verties whih o not have a high egree of freeom in hoosing olors. Sine verties along longer efault paths have fewer hoies (e.g. verties along x eep efault paths an pik one of x+ olors), they shoul e olore first. Therefore, aaptive algorithm proesses verties of all trees simultaneously, in a ereasing orer of the epth values. It hooses a vertex, an removes all ut one olor from its olor set, thus effetively oloring it. Whenever a vertex u is olore with olor, olor is remove from the olor set of all anestors an esenents of u, sine it an t e use to olor any of them. Then, all anestor verties of u are reursively olore. The algorithm is formally presente aove. A set olors is kept for every vertex an initially it ontains all C olors. One all ut one olor is remove from this set, the vertex gets olore. The steps involve in the oloring of two trees y the aaptive algorithm using four olors are illustrate in Figure... Coloring results In orer to evaluate, how uniformly the min-max an aaptive algorithms utilize various olors, we generate D FA suh that they have ifferent numers of efault transition trees in the orresponing forest. This was ahieve y limiting the efault path length to ifferent values. We also limite ourselves to use only + olors (where is the longest efault path), as allowing the use of more olors makes the oloring far easier. Our prinipal metri of oloring effiieny is the maximum isrepany in olor usage. If use(i) is the size (numer of verties times the numer of transitions it has) of all verties using the i-th olor, then the maximum olor usage isrepany will e, ( max use ( i) min use( i)) max use( i) i i Clearly, smaller values of isrepany reflet more uniform usage of various olors. We plot the maximum isrepany in olor usage in Figure, for ifferent numer of efault transition trees in the forest. It is apparent that aaptive algorithm uses olors more uniformly. Using the aaptive oloring algorithm, one we limite the efault paths to 7 or less, we were ale to map all of our D FA to memory moules suh that there was a maximum isrepany of less than 7 ytes in the memory oupany. i